fix(auth): normalize resource path dot-segments

[SarathChandraBellam]

Summary

• Resolve raw and percent-encoded dot-segments before checking resource hierarchy.
• Preserve repeated path separators and encoded separators such as %2F.
• Add regression tests for traversal and encoding cases.

Fixes #3303

Why

check_resource_allowed() previously used a direct startswith() comparison after only trailing-slash normalization. A requested resource such as /api/../admin could therefore pass a check configured for /api, even though it resolves outside the configured resource.

The implementation decodes only encoded dots (%2e), rather than fully unquoting the path. It then applies RFC-style dot-segment removal without collapsing empty path segments, so repeated separators remain significant. This avoids both path traversal and accidental widening of a resource boundary such as /api//.

Validation

• pytest tests/shared/test_auth_utils.py -q — 19 passed
• Full test suite — 5584 passed, 10 skipped, 1 xfailed
• Coverage — 100.00%
• Ruff check and format — passed
• Pyright — passed
• strict-no-cover — passed

AI assistance was used during investigation and implementation; I reviewed the resulting code and tests myself.

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[github-actions]

Thanks for the contribution. This repository only keeps pull requests open when they're linked to an issue that a maintainer has assigned to the author — CONTRIBUTING.md explains why and how we work. This PR has been closed for now because you aren't currently assigned to #3303.

If a maintainer would like this change as a PR from you, they'll assign you to #3303 and this PR will reopen automatically — there's nothing more you need to do. (If you opened the issue, this PR already shows up on its timeline.)

There's no need to open a new PR — this one will be reopened. While it's closed, please push any updates as new commits rather than force-pushing, since GitHub can't reopen a PR whose branch has been rewritten.

Maintainers: reopening this PR, removing the missing-issue-link label, or adding bypass-issue-check bypasses the check.